All Questions

0
votes
1answer
30 views

Is it possible to import an open source framework into a closed source project in ida?

I am working on reversing a closed source project that uses a well known open source framework. I am thinking that theoretically, by diffing the program and the framework, I should at least get a few ...
2
votes
1answer
65 views

IDA memory mirroring

I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF. How do I setup IDA to recognise memory mirroring.
0
votes
3answers
173 views

Most efficient way to begin analyzing malware binary

I'm taking a reverse engineering course and the class has just been given a big project where we have to analyze a packed malware binary. I am using a Windows 10 VM. I am a little confused on where to ...
1
vote
2answers
90 views

How to determine platform from .bin?

I have an android app (com.daye.dayeapp) to control my robot lawn mower. The App contains new firmware in the assets folder, in the form of a 122KB .bin file. How do I determine the architecture of ...
-1
votes
1answer
39 views

Not able to find Hard coded strings in the mac executable file

I know that there is a string called "Activate your subscription" used in this particular app. But Im not able to find this string from its executable. I tried strings myapp and also searched for same ...
0
votes
1answer
57 views

IDA PRO Tracing stopps

I need to get data from the window of the external program. This data is dynamic and changes each time the additional window is restarted. I have already found an offset, but I need to find the ...
1
vote
1answer
28 views

Frida command not available after installing Frida PIP Python package

Why is the frida command not available on the command line. After I install Frida by running $ pip install --user frida It looks like the installation was successful, but when I run the frida ...
0
votes
1answer
17 views

Is there a way to perform dex/smali/android class verification on linux or mac?

Is there a way to perform class verification on dex or smali files before the apk is pushed to the android device?
-1
votes
0answers
20 views

Help Nand flash reading with xD card (Teac CA-200)

I am trying to read the Nand Flash Samsung K9F2G08 with help of Teac Ca-200 card reader I have made connection as xD card pin out with Tsop-48 adapter now the flash is UN-detectable when I connected ...
2
votes
0answers
46 views

Does pwntools provide any Radare2 integration?

I want to use pwntools with Radare2, since this is my debugger of choice. However, I can only find GDB-related library calls in pwntools' documentation (pwnlib.gdb). Anyone with experience in ...
1
vote
2answers
60 views

How can I enumerate and hook into a Windows 10 RPC interface?

Suppose that I have a certain Windows service that I know exposes a local RPC interface. I want to create a client program that calls into these procedures; however, I do not have the source code for ...
-4
votes
1answer
113 views

Defence against cracking [closed]

Say I wrote an application and published demo version of it with a possibility to buy a full version. I was wondering if it is possible to stop people from cracking it, so that the only ones who use ...
0
votes
0answers
42 views

How to disassemble .mbn files?

I can't disassemble .mbn files using ida pro 7+ if I use some scripts from GitHub than I can't disassemble any function, any help ? I want to reverse qcom bootloader
0
votes
0answers
59 views

What changed after Android 8.0?

I compile code below use library Cydia Substrate, and run on a test application, and it works Android 4.4, 5.1, 6.0, 7.0, 7.1. But on Android 8.0+ application does not work with this code, why is that?...
0
votes
1answer
34 views

Stop currently running Ida Script mid execution

I ran an ida script and forgot to account for an infinite loop that keeps making a dialog pop up. Is there any keyboard command that will stop an Ida script from running mid execution? Thank you. I'm ...
1
vote
0answers
25 views

Getting a full trace (every line) from ollydbg

When I use the ollydbg run trace I don't seem to he getting every single line as I expect to. First off let me explain what Iexpect to see: Address hexDumb Command comments EAX ECX etc... 0042AD43 ...
0
votes
1answer
47 views

how to get address of PE section to jump in while backdooring PE binary

EDIT: I have posted this poste at security.stackexchange I am trying to follow this tutorial to backdoor a simple 32bits PE binary (putty.exe). The method used is to create a new section (named ....
2
votes
0answers
149 views

How to load symbols from a symbol server in Ghidra?

I've been trying to learn Ghidra by attempting to reverse the comctl32.dll system library, which has many of its functions documented. I started the de-compilation analysis in it, and after a while it ...
1
vote
0answers
25 views

IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)

I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these: Copied linux_server form IDApro into this VM and tried to run it, ...
0
votes
1answer
26 views

Android how can i hook native exported functions from a shared library *.so?

It needs to work even on older versions of android (3.x and above) specifically the old Sony "PS Certified" devices, the device im working with (Sony Tablet S) i have seen reports online that ...
1
vote
0answers
64 views

decompiled android application with only one class [DexProtector]

I'm trying to reverse engineering an android app and it's mostly for an experiment but I have a problem that I can't find a solution or even what is the problem. I decompiled an app with JADX-gui and ...
1
vote
1answer
57 views

Lipo alternate for linux

Currently, I'm using lipo tool to extract the arch type from a fat iOS binary on a Mac OS. Now, I want to do the same on the linux platform for the iOS binaries, i.e. extract a given arch type from a ...
0
votes
1answer
93 views

QEMU fpu mode error when attempting to run MIPS binary

I have unpacked a firmware binary using binwalk and have identified the architecture as MIPS by running file bin/busybox . When I try to run the binary with the proper static version of qemu, i get an ...
1
vote
1answer
93 views

Decryption loops

I'm reversing a CTF binary and I found a decryption loop decompiled by IDA like this: for ( i = 0; i < n; ++i ) { v22 = *((_BYTE *)sub_5657D89B + i); v0 = v22 ^ 0x90; v1 = strlen(&...
-1
votes
1answer
102 views

How can I convert the following assembly code to pseudo code?

I got the following disassembly code in IDA pro. I really find it hard to convert it into pseudo code. push ebp mov ebp, esp sub esp, 14h mov dword ptr [ebp-14h], 1 mov dword ptr [ebp-10h], 2 mov ...
6
votes
1answer
66 views

Detecting protected processes and critical processes from windows driver

I've got a driver that tamper user-space processes by sending APC calls upon process start using the call PsSetCreateProcessNotifyRoutine. I wish to avoid tampering with any process that is critical ...
1
vote
0answers
55 views

Decrypt ibt.sfi linux firmware(Intel Wireless 8265 Linux Bluetooth)

Why I want to decrypt: Intel 8265 Bluetooth is likely a RAMUSB device, which needs system to update firmware. I try to transplant this linux firmware to macOS. Problems I met: The macOS BT firmware ...
-1
votes
1answer
81 views

How can I convert the following disassembly code to pseudo code or C code?

I used IDA pro to get the following disassembly code. I am having difficulty converting it into the equivalent c code. mov dword ptr [ebp-8], 1 mov dword ptr [ebp-4], 0 loc_401014: cmp dword ptr [...
1
vote
1answer
99 views

Tool to search known hash/encryption algo in files in Windows

I am looking for a tool (the best would be an Ida plugin) that can search files in a folder for a known hash (md5/sha1 etc.) and encryption (aes /rsa etc.). I know an Ida plugin called FindCrypt2 but ...
0
votes
1answer
72 views

how watchpoint on register works

GDB has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for mips ? Is there a way to make it work for lldb also ? *...
0
votes
0answers
21 views

How to retrace Database Changes from a Software

i need to retrace database changes by an specific application. The database is really big(~8GB) and contains over 300 tables, and some of the tables have > 100 columns. Another Problem is, that the ...
1
vote
1answer
34 views

Startdard singleton class implementation generate access to TLS memory

I'v examine the assembly output in Windows of basic singleton implementation of using static variable to be initialized with new class instance from static function. to my surprise, although the ...
1
vote
0answers
37 views

Is there a way to generate a PE from a web assembly module?

I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
2
votes
0answers
237 views

Ghidra Control Flow Graph

Lately I'm using Ghidra and I don't find the API to get the control flow graph of a given function. Can someone help me? Thank you in advance. EDIT: it is different from the other question (link) ...
4
votes
1answer
113 views

Reverse engineering a compression algorithm to decompress ASCII text (LZ-variant?)

Reposted from StackOverflow as is. I'm trying to decompress a very long text block from an ARMv5t powered Gameboy Advance ROM, which was compressed using some kind of custom LZ-esque compression ...
4
votes
1answer
110 views

Tektronix firmware XOR puzzle

As a means of learning about packing firmware and for fun I am trying to unpack the latest firmware for an entry level Tektronix Function generator firmware attached I have read the forum and ...
1
vote
0answers
32 views

How do I decode arbitrary data from a raw extracted binary?

I have a IoT scale that stores my measurements into records and passes them onto my phone. I was able to read directly off a flash chip and create a binary file. The chipset is ARMv7. I want to be ...
0
votes
0answers
44 views

Any way to edit an ELF binary without hex? [duplicate]

So, this is a noob question, I am a complete beginner in this field, so sorry if I'm wasting your time in any way. I wanted to know, if there is a way to edit an ELF binary without using a hex editor....
1
vote
0answers
40 views

Finding the function of test points on a router

I have a BCM3383 based cable router here where I ultimately want to dump the firmware. I have serial access to the broadcom bootloader and the linux console. Login for linux is unkown and telnet does ...
1
vote
1answer
54 views

How to get IOCTLs from all NtDeviceIoControlFile function call?

Inspired by this answer about RE-ing IOCTLs, I tried to get the IOCTLs from NtDeviceIoControlFile() syscall. Here is an example of that syscall in Beep() function in KernelBase.dll file: In x86_64 (...
0
votes
2answers
258 views

What's happening in the assembly main function?

I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here. Where should I set the breakpoints (...
0
votes
1answer
59 views

Where can I go to learn about decryption? [closed]

I understand the basics of encryption and decryption, but I don't know where to go to talk to people and learn more. Are there any forums or resources to look at to learn more? For example, I was ...
0
votes
0answers
46 views

Vulnerabilities of Binary executed by root

I was given a vulnerable 64bit dynamically linked stripped that runs simple checks to determine the strength of the passwords of users on a linux system. The app checks if it the EUID is 0 and then ...
1
vote
1answer
46 views

How is thumb branch calculated

I have the instruction which is: 5ff1aed4 bl sub_5ff171d0 which assembles to: FCF77CF9 This appears to mean that the program is branching backwards, However I can't seem to find ...
2
votes
1answer
64 views

GDB: Could not load shared library symbols

I'm currently having a look at the Damn Vulnerable Router Firmware, and I'm roughly following the description that is given here: https://p16.praetorian.com/blog/getting-started-with-damn-vulnerable-...
1
vote
0answers
403 views

How to export a working elf binary from Ghidra?

When patching a program and then using the export binary function, it turns the elf headers are corrupt. Is there any way to work around this problem?
1
vote
2answers
64 views

segmentation fault at `mov byte [esi+7], al`

Section .text global _start _start: jmp short GoToCall shellcode: pop esi xor eax, eax mov byte [esi+7], al lea ...
1
vote
2answers
103 views

How to inject JavaScript into a browser with Frida?

I'm learning how to use Frida, and would like to do something basic like inject JavaScript into a browser on Windows to list all running tabs. It seems like it should be possible as Frida allows you ...
3
votes
1answer
52 views

PowerPC ELF32 detecting VLE

I am writing an ELF32 parser and disassembler for PowerPC. Does anyone knows how to detect if the file is using VLE architecture from ELF header? I see that IDA can do it automatically.
2
votes
1answer
86 views

Android application fuzzing

How to do fuzzing in Android applications? Do we have any fuzzer specific to the android? Actually, I am looking for an easy way to do fuzzing while performing penetration testing of android ...

15 30 50 per page